001 ASP ?001 ASP ? ASP ? ? Web ? ASP? HTML ? COM ? ASP ? HTML ? web ? 002 ASP ?002 ASP ? ? (DataBase Path Leak)? (DataBase Path Leak) ? ASP+Access ? WEB ?%5c ?IIS ? %5c ? ?IE ?%5c ?/,?asp ? conn.asp? ? 1. ? ? http:/www.aspmps.com/cn%5cconn.asp IIS ? ? ? ? ? ? ACCESS ? SQL server? 360 ?http:/tech.163.com/digi/12/0312/15/7SDHI0LJ00163HE0.html? ? ? ? conn.open connstr ? On Error Resume Next ? IIS ? 2 ?(Cross-Site Scripting)?(Cross-Site Scripting) ?Cross-site scripting(XSS)? Web ? Web ? HTML ?(CSS)? XSS? XSS ?(same origin policy)?phishing ?cookie ?Xss ? ? ? ? ? ? XSS ? ? 1. ? Request.Form ? content ? XSS ? ? ? ? ? ? COOKIES ? xxx ? cookies.asp ? COOKIES ? 1. ?“”? HTML ? ?(Cross Site Request Forgery)?(Cross Site Request Forgery) ?CSRF ? Cross Site Request Forgery ? WEB ? URL ? ? JS ? ? HTMLEncode? 1. Public Function HTMLEncode(str) 2. If Not IsNull(str) Then 3. str = Replace(str, Chr(38), “ 2. if(window.XMLHttpRequest) 3. request = new XMLHttpRequest(); 4. if(request.overrideMimeType) 5. request.overrideMimeType(text/xml); 6. 7. else if(window.ActiveXObject) 8. var versions = Microsoft.XMLHTTP, MSXML.XMLHTTP, Microsoft.XMLHTTP, Msxml2.XMLHTTP.7.0,Msxml2.XMLHTTP.6.0,Msxml2.XMLHTTP.5.0, Msxml2.XMLHTTP.4.0, MSXML2.XMLHTTP.3.0, MSXML2.XMLHTTP; 9. for(var i=0; i ? Request.QueryString(“FileName”) ? URL? ? ?“down.asp?filename=./cn/index.asp%20”? %20 ? URL ?%2E ? URL ?“.”? ? ?(File Upload)?(File Upload) ? ASP ?” ? “?” ? “?” ? ? ?1.? ASP ? Upfile.asp? 1. “/“ then formPath=formPath.mpg ? 3. ? ? ?“cer|ccerer”? ? ccerer ? 1. ? ccerer? FixName = Replace(FixName,”cer”,”“) ? ccerer ? cer ? cer ? ? ? ? ? cer ? ? cer ? ? ? cer ? ? IIS ? cer ? asp ? ? “? MIME ?“Javascript ? ?.Cookies ?(Cookies Spoofing)?.Cookies ?(Cookies Spoofing) ? ? Cookies ? ? Cookies ?Cookies ? Cookies ? ? ? Cookies? ?Cookies ?Cookies? ? Web ? ? ID? ? UploadSoft.asp ? ? Cookies ? ? Cookies ? ? 1. ? IF ? Session ? Cookies ? upload_0()? ? Cookies ? ? ? ? asp163=UserName=asp ? Cookies ? ? Cookies ? ? ? ? Cookies? Session ? ?(Local File Inclusion) ?ASP Execute ? ASP ? ASP ? ? ? ASP ? ? ASP ? PHP ? Execute ? ? equest ? file ? Execute ? ? ? ? ASP ? ASP ? ? jpg ? ASP ? WebShell? ? ?(Path Manipulation)?(Path Manipulation) ? file system ? ? path manipulation ? 1. ? file system ? 2. ?